feat(multiverse): durable ordered placement and lifecycle admission

[loganj]

Draft scope

Compact latest Start and host-specific Stop projection; separate one-shot request consumption and immutable saved outcomes. This source slice is wired into Desktop by the receiver descendant; its executable tests run there.

Depends on feat/lifecycle-transport-16211fef; part of six dependent drafts atop #7347 (dfce9ba3). Frozen inventory/Stop heads are unchanged. Head: 2c70a68dce7d07c3f0fd0bd6d3b04339dc76b22d.

Evidence

The composed candidate 5ec1955862d11bd9c01b7e3318f09b7076101423 passed full just ci, 6,266 frontend tests, production artifact build, 3,178 native unit + 10 integration tests, and native/workspace Clippy. This is composed-candidate evidence, not a claim that each earlier unmounted slice independently exercises the whole feature. Splitting changed no product bytes.

Earlier direct package attempts exposed environment limitations: relay media tests lacked a configured PostgreSQL pool; a direct buzz-db source-attribution guard failed in the unchanged production source; the first separate PostgreSQL lane failed local setup before tests. Full just ci subsequently passed its configured lanes. Separate populated PostgreSQL/private relay evidence is being collected, not assumed green.

Explicitly unperformed / not delivered

• No two-Desktop/two-Mac lifecycle walkthrough, successful real relocation, or real process-tree cleanup acceptance. These are documented limits, not a drafting gate.
• No deployed host-owned broker credential provisioner. Production Start/Restart cannot spawn a new keyless runtime until that integration is supplied; the current provider returns provisioning_unavailable. Injected success tests are not deployed provisioning evidence.
• No keys, files, configuration, or workspaces transferred. No auth weakening, arbitrary signer, or keyful launch fallback.
• Draft only: no merge, deployment, release artifact, or technical approval claimed.

Product authority

Approved Multiverse semantics: newer sender seconds/lower event-ID ties; scoped Stop; current-host-only Restart; failed/interrupted Move has no automatic continuation. This follows the settled Multiverse design rather than the older provider/key-transfer vision in VISION_REMOTE_AGENTS.md.

Origin channel: f45d3304-dcf0-44e8-a46d-bcd63b235fbc
Origin thread: 16211fefcee85904f49802ce5e1709bf24b4895401a944f0585e70233c4e4d39
Owner drafting direction: 4ed62424758aea3898b084f9e24d7fd9791d7dc53738d01ed1c0dbbae1adb8e7.

[loganj]

Additional exact-head validation

At composed tip 5ec1955862d11bd9c01b7e3318f09b7076101423, the separate PostgreSQL lane now passes 260/260 (all buzz-db ignored PostgreSQL tests plus the Desktop transport tests). This includes populated migration 0049 and both lifecycle kinds through authenticated HTTP/WS privacy and exact-request duplicate redelivery.

The previous 259/260 result was a fixture URL spelling issue: an unchanged test strips postgres:// literally; the initial local admin URL used postgresql://. Using the test-supported URL spelling resolved it with no product change.

Full composed just ci, 6,266 frontend tests, 3,178 native unit + 10 integration tests and Clippy remain passed. Real two-Desktop/process-cleanup acceptance and deployed broker provisioning remain explicitly unperformed/unimplemented; this evidence does not establish real relocation.

[loganj]

Current-head CI classification (2c70a68d): Desktop Core passed. Smoke shard 4 failed in the unchanged workflow editor test workflow-local-controls.spec.ts:267 (waiting for Edit workflow → Trigger; one retry also failed a canvas geometry assertion). Eight other workflow tests were flaky and then passed. This PR changes only two native placement files; desktop/src, desktop/tests, package.json and Playwright config are identical to #7350, whose smoke shard 4 passed. The mock-bridge smoke lane does not execute these native files. Classified as unrelated workflow smoke instability, not a lifecycle regression; no workflow code changed. Remaining relay integration jobs are still running. Failure: https://github.com/block/buzz/actions/runs/33922676429/job/101184419265